topic Hello.I tried several in Network Security

hairpinning (cisco asa) to the same IP address

jcarvalh — Tue, 12 Mar 2019 05:06:30 GMT

Hello.

I have a client migrating to a Cisco ASA.

I have two interfaces (inside and outside); lets say that outside interface has IP address 172.16.1.1 and inside users are in network 192.168.10.0/24.

I have a static NAT mapping 172.16.1.1 to 192.168.10.1 on port 80 (for outsider acess to a vital application); also, I have PAT (to outside interface)configured for inside users to access to internet.

My problem starts when inside users use public IP address (172.16.1.1) to access the vital application; this means that the firewall sees traffic from 172.16.1.1 (users) to 172.16.1.1 (aplicattion) and it drops the traffic.

Is there anyway to bypass this? I think that with another public ip address I would have no problem, with one IP used for PAT and the other for the application but my client does not want to purchase another IP.

Thanks,

João.

P.S. - I try to tell then to change DNS records but they say that application uses embedded ip addresses.

Dear Joa0, Try to map the

shahul hamid zehabar sathik aly haja meidine — Thu, 20 Nov 2014 05:28:21 GMT

Dear Joa0,

Try to map the port with 8080 not only 80.

Hello.I tried several

jcarvalh — Thu, 20 Nov 2014 15:49:39 GMT

Hello.

I tried several solutions that I found on internet and foruns but none worked.

I then tried this one and it worked:

nat (Inside,Inside) 2 source dynamic LAN NAT-for-hairpinning destination static Interface-Outside ORION service HTTP HTTP

LAN - Is my inside Network (lets say 192.168.10.1)

NAT-for- hairpinning - IP address not used in organization and used exclusively to source nat my inside network (I used 172.16.0.1)

Interface-Outside - is a network object with IP address of outsider interface

ORION - is internal server (192.168.10.1) in same network na LAN

For me, using the NAT-for-hairpinning object was the only way to put it to work.

Hope this post can be helpfull.

Regards,

João.

P.S. - ASA has version 9.1